---
id: CVE-2026-77680
title: >-
  Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing
  after cve-2025-32907 fix
summary: >-
  An algorithmic complexity flaw exists in libsoup's HTTP Range header
  processing that persists after the CVE-2025-32907 fix.


  CVE-2025-32907 addressed memory amplification when a client repeated the same
  range many times in a single Range…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-407
vendor: Red Hat
product: libsoup3
affected:
  - libsoup3 (all versions)
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-08-26T12:38:58.296657Z'
exploitAvailable: true
published: '2026-08-25'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T00:45:32.456Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-77680'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2025-32907'
    label: CVE-2025-32907
  - url: 'https://access.redhat.com/security/cve/CVE-2026-77680'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2520892'
    label: RHBZ#2520892
  - url: 'https://gitlab.gnome.org/GNOME/libsoup/-/issues/538'
  - url: 'https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/550'
tags:
  - cve.org
  - exploit-available
epss: 0.00344
epssPercentile: 0.28073
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/OJ01-creates/CVE-2026-77680-Security-Analysis'
  checkedAt: '2026-11-06T01:43:46.087Z'
ingestedAt: '2026-11-06T01:43:15.134Z'
---

## Overview

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix.

CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range.

The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. Reporter measurements on libsoup HEAD containing the CVE-2025-32907 fix show ~90 ms single-core CPU per such request at the wire maximum, blocking the server's event loop for that duration.

This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs.

Affected: libsoup versions containing the CVE-2025-32907 fix but not merge request !550.
Fixed upstream: MR !550 merged 2026-08-20, replacing per-element removal with O(N) in-place compaction and rejecting Range headers requesting more than 200 ranges.
Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/issues/538
Related: CVE-2025-32907

## Affected

- `libsoup3 (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Upgrade to a libsoup version containing merge request !550 (O(N) range coalescing and 200-range limit). Until patched, restrict network access to services using SoupServer, or terminate connections that send Range headers with excessive range counts.